[ubuntu/jammy-security] ironic 1:20.1.0-0ubuntu1.3 (Accepted)

[Federico Quattrin]

ironic (1:20.1.0-0ubuntu1.3) jammy-security; urgency=medium

  * SECURITY UPDATE: sanitize kernel_append_params to prevent injection
    - debian/patches/CVE-2026-46447.patch: Validate kernel_append_params
      against a kernel command line grammar and reject malformed
      parameters. Add disable_kernel_parameter_parsing config option.
    - CVE-2026-46447
  * SECURITY UPDATE: disable insecure driver_info pxe_template override
    - debian/patches/CVE-2026-44917.patch: Remove direct file path support
      for pxe_template to prevent privilege escalation.
    - CVE-2026-44917
  * SECURITY UPDATE: prevent directory traversal in ISO9660 image handling
    - debian/patches/CVE-2026-48681.patch: Validate ISO9660 path entries
      to reject directory traversal attempts in config drive ISO images.
    - CVE-2026-48681

Date: 2026-06-11 14:26:12.312512+00:00
Changed-By: Federico Quattrin <federico.quattrin at canonical.com>
Maintainer: Chuck Short <charles.short at windriver.com>
https://launchpad.net/ubuntu/+source/ironic/1:20.1.0-0ubuntu1.3
-------------- next part --------------
Sorry, changesfile not available.